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In a comment, Xu, Curty, Qi, Qian, and Lo claimed that discrete-variable (DV) measurement 
device independent (MDI) quantum key distribution (QKD) would compete with its continuous- 
variable (CV) counterpart at metropolitan distances. Actually, Xu et al.’s analysis supports exactly 
the opposite by showing that the experimental rate of our CV protocol (achieved with practical 
room-temperature devices) remains one order of magnitude higher than their purely-numerical and 
over-optimistic extrapolation for qubits, based on nearly-ideal parameters and cryogenic detectors 
(unsuitable solutions for a realistic metropolitan network, which is expected to run on cheap room- 
temperature devices, potentially even mobile). The experimental rate of our protocol (expressed as 
bits per relay use) is confirmed to be two-three orders of magnitude higher than the rate of any 
realistic simulation of practical DV-MDI-QKD over short-medium distances. Of course this does 
not mean that DV-MDI-QKD networks should not be investigated or built, but increasing their rate 
is a non-trivial practical problem clearly beyond the analysis of Xu et al. Finally, in order to clarify 
the facts, we also refute a series of incorrect arguments against CV-MDI-QKD and, more generally, 
CV-QKD, which were made by Xu et al. with the goal of supporting their thesis. 


In a recent comment [I| , Xu et al. claimed that discrete 
variable (DV) measurement device independent (MDI) 
quantum key distribution (QKD) was unfairly com¬ 
pared to a novel high-rate continuous variable (CV) pro¬ 
tocol Here we show that this claim is false and we 
fully clarify this DV-CV comparison. However, before 
going into the details of this comparison, we need to rec¬ 
tify a series of incorrect and misleading statements made 
by these authors against CV-MDI-QKD and, more gen¬ 
erally CV-QKD, with the aim of supporting their thesis. 


Features of CV-MDI-QKD 

First of all, contrary to the claims of Xu et al. [l|, 
the CV experiment of (3 is performed with cheap room- 
temperature components (optical modulators and homo¬ 
dyne detectors) in a regime of parameters which are eas¬ 
ily achievable in practice. Modulations of ~ 60 shot 
noise units are relatively low with respect to what is 
achievable (100 and more). Reconciliation efficiencies of 
^ ~ 97% are currently state-of-the-art in CV-QKD exper¬ 
iments (l^ - [l^ . An experimental excess noise e cs 0.01 
is not low but typical, fully comparable with the values 
reported in the fibre-optic experiment of El , where the 
experimental excess noise was estimated to be e ~ 0.001 
at 10® data points and e ~ 0.008 at 10® data points, for 
Bob’s detection at 53 km. At lower distances < 25 km (as 
is in our case), the excess noise is expected to be smaller, 
which means that our experimental value e ~ 0.01 can 
even be considered relatively high. The robustness of 
CV-MDI-QKD against excess noise can also be appreci¬ 
ated from the analysis done in the Supplementary Section 


IE6 of @ (in particular, see Fig. 5 there), where the se¬ 
curity thresholds are proven to be robust against much 
higher excess noise (e = 0.1). 

Then, Xu et al. [I| completely missed an important ad¬ 
vantage of CV-MDI-QKD, which is the extremely good 
performance of CV detection performed at the relay. 
This crucial feature relies on two basic facts: 

( 1 ) The detection setup of CV-MDI-QKD is completely 

different from that of one-way CV-QKD protocols. 

( 2 ) CV Bell detection is deterministic and highly effi¬ 

cient (also in telecom setups). 

Let us explain these points in detail and the reader may 
also refer to the panels in Fig. [T] 

In one-way (or point-to-point) CV-QKD protocols (see 
Fig. Er), Alice prepares outgoing quantum states while 
Bob detects states incoming from the channel. Because 
of this configuration, only the loss within Alice’s station 
can be trusted and, therefore, neglected by re-scaling the 
signal level at the output of Alice’s box. The loss within 
Bob’s station cannot be re-scaled since it is added on top 
of channel loss and noise (any re-scaling will also amplify 
the loss and noise of the channel, without any signal-to- 
noise advantage). For this reason, Bob’s overall quantum 
efficiency is limited and this clearly affects fibre-optic 
implementations at telecom wavelengths. For instance, 
a quantum efficiency of 60% was reported in Ref. 0 
due to optical manipulations and photo-detection (how¬ 
ever, note that this specific value of 60% can be improved 
and, therefore, should not be considered as a fundamental 
limit for the detection in one-way CV-QKD protocols). 

By contrast, in the setup of CV-MDI-QKD depicted in 
Fig. [TJd, both Alice and Bob prepare outgoing quantum 
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FIG. 1: Experimental loss in CV-QKD configurations (see text for more details), a, One-way CV-QKD protocol with limited 
efficiency within Bob’s station, due to unscalable loss, b, Proof-of-principle demonstration of CV-MDI-QKD in free-space 
at optical/infrared regime (1064 nm) with ~ 98% efficiency for the CV Bell detection, c, Proposal for a fibre-optic telecom 
implementation of CV-MDI-QKD, where fibre-outcoupling and free-space CV Bell detection achieve ~ 95% efficiency. 


states in their private stations, where loss and noise are 
trusted. For this reason, both the signal levels of Alice 
and Bob can be set at the output of their stations, so 
that the effect of the internal losses can be completely 
neglected. Untrusted loss and noise will only affect the 
channels and the detection at the relay. The latter has 
extremely high efficiencies, indeed rjd ~ 98% in our free- 
space experiment at optical wavelengths (1064 nm). 

Here it is worth remarking that the CV version of Bell 
detection can be done deterministically with simple lin¬ 
ear optics and photodetection [T^, contrarily to the 25% 
probability success affecting DV-MDI-QKD and the typ¬ 
ical 50% value bounding teleportation experiments with 
photonic qubits fisl - f^ . Most importantly, the quantum 
efhciency of the homodyne detectors in CV Bell detec¬ 
tions is extremely high. Contrary to the incorrect claims 
of Xu et al. [I| , homodyne detectors with high efficiencies 
have been seen in both optical and telecom setups: 

[Optical Setups] These include the various free-space 
CV teleportation experiments |1^ . but also fibre- 
based experiments, such as RefT^ Q, where cou¬ 
pling efficiency to a fibre can be as high as 98 — 99% 
and the quantum efficiency of photo-detectors can 
be > 99%, with an overall efficiency of about 
97- 98% [13 • 

[Telecom Setups] For instance, see Ref. m , where the 
performance of a balanced homodyne detection at 
1550 nm is 98%, by means of InGaAs PIN diodes 
with an active area of 500 /rm in diameter and 
a quantum efficiency of ^ 99%, together with a 
fringe visibility of 99.5% at the beamsplitter. See 
also Ref. [l^], where the overall efficiency of the 
balanced homodyne detector at 1550 nm is 95%. 
This is performed in free space at the output of a 
10 m fibre, and the total 95% efficiency includes 


both fibre in-coupling (the largest source of loss) 
and outcoupling (estimated to be 0.1%) (T^ - 

A simple fibre-optic implementation of CV-MDI-QKD 
at telecom wavelengths can be done as shown in Fig. [TJ:. 
Here the loss within Alice’s and Bob’s stations (e.g., as¬ 
sociated with fibre connections and modulators) can all 
be re-scaled as trusted loss. At the relay, the CV Bell 
detection can be done in free space. The efficiency as¬ 
sociated with fibre out-coupling is close to 100% if the 
fibre facet is anti-reflection coated. The efficient of the 
subsequent CV Bell detection is basically determined by 
the homodyne detectors which may have 98% efficiency 
at 1550 nm [ij. For instance, the CV Bell detection can 
be done in the simplified setup of Ref. [3 involving a bal¬ 
anced beam-splitter and two photodectors. Considering 
0.2 dB insertion loss for the beam splitter and 99% effi¬ 
ciency for the diodes m , one realizes a CV Bell detection 
with ~ 95% efficiency. This means that the performance 
of our proof-of-principle experiment can be achieved in 
a future fibre-optic telecom implementation, contrary to 
the conjectures made by Xu et al. [l| where the proto¬ 
col was analysed by assuming too low efficiencies for the 
detection at the relay (down to 85%). 

Unfortunately, yet other claims made by Xu et al. [I[ 
were wrong. Contrarily to what they state: 

(i) The asymptotic rate of [3 is not an upper 
bound but a lower bound with respect to all possi¬ 
ble attacks. In fact, the experimental rate is computed 
from Alice and Bob’s shared classical data assuming the 
whole environment belongs to Eve. Then, the theoretical 
rate is derived against optimal attacks. More precisely, 
this is minimized over all two-mode Gaussian attacks in 
normal form after the application of the de Finetti theo¬ 
rem and the extremality of Gaussian states [13 . This is 
in contrast with the partial (and purely numerical) anal- 
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yses in which only considered the simple case of 

two independent entangling doner attacks, as thorou ghly 
discussed in Ref. . More details may be found in [25l |. 

(ii) Fin ite-size effects against coherent at¬ 
tacks |l4l4l6| and composable security in the pres¬ 
ence of collective attacks [ 2 ^ support our results. 

It is true that our theoretical rate is derived in the asymp¬ 
totic limit of infinite signals but there is no evidence 
that it would be sensibly affected by finite-size analy¬ 
ses. In fact, the current finite-size analyses tend to the 
asymptotic limit for blocks of > 10® data points (e.g., 
see Fig. 1 of [1^), which is the size considered in our ex¬ 
periment This is also the size of data blocks consid¬ 
ered in the experiment of Ref. da , where the finite-size 
key rate is shown to well-approximate the asymptotic 
regime, especially below 30 km, as is clear from Fig. 2 
of El. Note that (point-to-point) coherent-state proto¬ 
cols are composable-secure against general coherent at¬ 
tacks, but the present proof techniques are not sufficient 
to prove fast convergence [l^, HI . The fact that a proof 
is currently missing does not mean that such convergence 
cannot be shown with another method, i.e., there is no 
fundamental reason to conjecture that the composable- 
secure key rates of coherent-based CV-QKD protocols 
should not lastly converge to the asymptotic values. In¬ 
deed this fast convergence has been already proven in 
the most general case for squeezed-state CV-QKD [^ . 
By contrast, we note that finite-size analysis seems to 
be very demanding for DV-MDI-QKD, where blocks of 
> 10^° data points are needed for achieving reasonably 
non-zero rates with practical detectors (see Fig. 4 of [^b 

(iii) The relay doesn’t need to be in Alice’s lab. In 

fact, all configurations (symmetric or asymmetric) show 
a non-trivial advantage with respect to DV-MDI-QKD at 
metropolitan distances (5 — 25km). 

(iv) The use of a single local oscillator is not a 

major security flaw in CV-QKD and its removal 
is no longer an experimental challenge. The use of 
a single local oscillator is typical in all CV-QKD imple¬ 
mentations so far. Practical security against its potential 
manipulation can be achieved if one implements an ac¬ 
curate real-time measurement of the experimental shot 
noise Furthermore, CV-QKD can also be imple¬ 

mented using two independent local oscillators followed 
by classical post-processing [3ll - l^ . Thus, the “source 
requirements” brought up by Xu et al. (Appendix D 
of [l|) are easily overcome. Regarding this issue of us¬ 
ing a single laser, it is important to remark that Xu 
et al.’s comment El is not just against CV-MDI-QKD 
but the entire field of CV-QKD. According to Xu et al.’s 
‘criteria’, all CV-QKD protocols implemented so far, in¬ 
cluding the first ground-breaking table-top experiment 
of Ref. and the long-distance experiment of Ref. E3 
wouldn’t be, as they put it, “properly designed QKD 
demonstrations” for their use of a single local oscillator. 

(v) Fast homodyne detectors exist plus CVs re¬ 
main superior even on slower clocks. In the op¬ 


tical range, homodyne detection can be done at GHz- 
bandwidths 3^, with 80MHz detectors being available 
with efficiencies > 86% [1^ and, more recently, lOOMHz 
detectors at 99% efficiency [37j. This is a technology 
which has large room of development at telecom wave¬ 
lengths, where a field implementation of CV-QKD has 
been already achieved at IMHz clock [l^. This scenario 
has to be compared with the 75MHz clock rate imple¬ 
mented in DV-MDI-QKD [s^, while ICHz has only been 
used for point-to-point BB84, with detector efficiencies of 
about 20% [ 3 ^ (now increasable up to 55% [i^). Here it 
is important to note that the difference, in terms of bits 
per use, can be so large that CVs may achieve higher 
rates than DVs while using much slower clocks. For in¬ 
stance, in the case of point-to-point QKD, a 50MHz-clock 
CV protocol is already sufficient to outperform a IGHz- 
clock protocol with DVs at metropolitan distances E3- 
Since there are about three orders-of-magnitude in the 
rate (bits per use) between practical GV-MDI-QKD and 
practical DV-MDI-QKD, the GV protocol could run on 
clocks which are three orders-of-magnitude slower and 
still achieve the same performances of DVs. For this rea¬ 
son, a fibre-based telecom implementation of CV-MDI- 
QKD at 1 MHz is hard to beat by any practical imple¬ 
mentation of DV-MDI-QKD (see below for a full clarifi¬ 
cation of the word “practical” in this context). 


Actual comparison between CVs and DVs 


Having refuted the various incorrect claims and conjec¬ 
tures made by Xu et al. regarding CVs, we now perfom 
a detailed comparison between CVs and DVs, consider¬ 
ing a realistic analysis of DV-MDI-QKD. We can easily 
see that practical parameters and cheap components for 
DVs are certainly not those stated in Xu et al.’s com¬ 
ment [ij but those considered by four of these same au¬ 
thors in an earlier paper on “practical aspects” of DV- 
MDI-QKD [4l|. Practical DV-MDI-QKD involves stan¬ 
dard single-photon detectors with r]d ~ 14.5% efficiency 
and a Vo — 6 x 10“® dark count rate, together with typical 
values of the intrinsic error rate ~ 1.5% and error cor¬ 
rection efficiency parameter /e = 1.16 [l^. This is state- 
of-the-art for room-temperature (20°C) or thermoelectri- 
cally cooled (-50°G) semiconductor (InGaAs) avalanche 
photodiodes (APD) detectors [HjliJ, typically operat¬ 
ing at 10 — 30% efficiency but with increasing dark counts 
(see Fig. 2 of [i^b 

Assuming these realistic and practical parameters, one 
can easily compute an estimate of the rate for DVs by 
assuming infinite decoy states, neglecting finite-size ef¬ 
fects and other errors such as time-jitter and mode mis¬ 
match (see Appendix for details). From Fig.[2]we see how 
the rate of the practical DV-MDI-QKD is below that of 
the practical GV-MDI-QKD by 3—4 orders-of-magnitude 
over metropolitan distances, from 6km in the symmetric 
case up to 25km in the most asymmetric configuration. 
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FIG. 2: Comparison between the rates (bits per relay use) of CV-MDI-QKD and DV-MDI-QKD versus total Alice-Bob distance 
(in fibre-equivalent at 0.2dB/km) and assuming different configurations for the relay in the various panels a-d. a, relay in Alice’s 
lab. From bottom to top we consider: (1) Rate of practical DV-MDI-QKD with standard semiconductor detectors {rid — 14.5%, 
Cd — 1.5%, Vo ~ 6 X 10~®, fe = 1.16). (2) Rate of the optimal realistic DV-MDI-QKD with the best semiconductor detectors 
{rid — 55%, Yo — 5 X 10“"^). Lower bound of the gray band refers to typical error Cd — 1.5%, while the upper bound refers 
to Cd — 0.1% {fe = 1.16 in all cases) (3) Rate of ideal DV-MDI-QKD with cryogenic 93%-efliciency SNSPDs {rid — 93%, 
Cd — 0.1%, Yo ~ 10~®, fe = 1.16). (4) Rate of practical CV-MDI-QKD with room-temperature cheap components {rid — 98%, 
e ~ 0.01, V? — 60, ^ = 97%); squares are experimental data. (5) Rate of CV-MDI-QKD with ideal reconciliation efficiency 
(as before but ^ = 100%). (6) Secret-key capacity of the total channel between Alice and Bob, lowerbounded by [^. and 
upperbounded by [i^. b, as in a but with a 100m-fibre between Alice and the relay, c, as in a but with 1km-fibre between 
Alice and the relay, d, symmetric case where Alice and Bob are equidistant (in simulated fibre) from the relay; no experimental 
data for this specific configuration. 


It is interesting to study the maximum rate that one 
can achieve with DVs by using semiconductor detectors. 
Since we are interested in short to medium distances and 
high rates, the choice is for detectors with the highest effi¬ 
ciency (despite their high dark counts). The best solution 
appears to be the very recent InGaAs/InP APDs oper¬ 
ated in optimized self-differencing mode at room temper¬ 
ature by Toshiba [i^ . These achieve rid ~ 55% efficiency 
with background rates lb — 5 x 10“'*’ at 20°C. Fixing 
fe = 1.16 and considering Cd in the range 0.1% — 1.5% 
we can estimate the optimal performance of realistic DV- 
MDI-QKD in the lower gray band shown in Fig. As 
we see from the figure, the optimal DV-MDI-QKD with 
semiconductor detectors is very good but still between 2 
and 3 orders of magnitude below the already experimen¬ 
tally achieved CV rate over typical metropolitan ranges. 

In their comment, Xu et al. [I| compared our practical 
CV experiment with a purely-theoretical numerical ex¬ 
trapolation for DVs, which is based on nearly-ideal pa¬ 


rameters and devices. In particular, they consider an 
extremely-low intrinsic error rate Cd — 0.1% [s^ (which 
would be very demanding to realise with real-time mod¬ 
ulators in a scalable practical network) and the most 
advanced superconducting nanowire single-photon detec¬ 
tors (SNSPDs). These detectors operate below 2K with 
r]d — 93% efficiency and a lb — 6 x 10“® background 
rate . It is interesting to note that two of the authors 
of Xu et al. [I| seem to be aware of the limitations of the 
applicability of these SNSPDs to a real practical scenario, 
as they openly admitted in a previous publication: 

“The main drawback of these novel SNSPDs, 
however, is their operating temperature, 
which is currently of the order of 0.1 K.” 

[Lo, Curty & Tamaki, Nature Photon. 8, 595-604 (2014)] 

It is evident that such an ideal and cryogenic version of 
DV-MDI-QKD is too demanding for the realistic con- 
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struction of a scalable network (more details may be 
found in (d^l. Remarkably, even considering these over- 
optimistic parameters, our practical CV protocol is still 
~ 1 order-of-magnitude better than this ideal extrapola¬ 
tion with DVs in all the configurations of Fig. [2j 

Furthermore, one can easily verify that the DV rate 
collapses down by another 1 — 2 orders-of-magnitud e by 
employing more standard SNSPDs with rjd < 45% 

By contrast, slight improvements in the reconciliation ef¬ 
ficiency of classical protocols of error correction and pri¬ 
vacy amplifications may provide further non-trivial gains 
for CVs. As we see in Fig. [51 the CV theoretical rates 
with ideal reconciliation = 100%) is very close to the 
secret-key capacity of the total Alice-Bob channel 
achievable by CV-QKD protocols. 

That being said, our analysis here does not want 
to discourage the implementation of DV-MDl-QKD at 
metropolitan distances. While Xu et al.’s cryogenic 
version of DV-MDl-QKD does not seem to be suit¬ 
able for building a realistic and low-cost metropoli¬ 
tan network, an implementation of DV-MDl-QKD with 
room-temperature (or slightly-cooled) semiconductor- 
based single-photon detectors is not only realistic but 
appealing, and may be the basis of a secure quantum net¬ 
work with intermediate rates. We therefore strongly en¬ 
courage serious and careful research in this direction. It 
would also be interesting to explore potential hybrid DV- 
CV approaches, as it is now happening for other quantum 
protocols (e.g., see quantum teleportation [II)- 


In conclusion, our take-home message is the follo wing : 
DV-MDl-QKD is very good for long distances [^[5fll . [^ . 
but its rate struggles to be increased at various dis¬ 
tances, thus motivating the proposal of alternate strate¬ 
gies by the community [^. By contrast, CV-MDl- 
QKD [i, m struggles with long distances but can po¬ 
tentially provide much higher rates at the metropolitan 
range (5 — 25km), extending what happens for point-to- 
point CV-QKD [l^, This statement must not come 
as a surprise since CV systems are fragile to loss (lim¬ 
iting distance) but they can encode a lot of information 
thanks to their theoretically infinite-dimensional Hilbert 
space [l^. Furthermore, besides the use of cheap and 
practical devices, CVs can easily go broadband. 
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Appendix A: Secret-key rates 
1. Secret-key rate of DV-MDI-QKD 

An estimate for the secret key rate of polarisation¬ 
encoding DV-MDI-QKD can easily be computed by as¬ 
suming infinite decoy states and signals (i.e., ignoring 
finite-size effects and composability) and neglecting a 
series of technical errors, such as time-jitter, spectral 
mismatch, pulse-shape mismatch and fluctuations of the 
source intensities. This is effectively an upper bound 
to the actual performance of DV-MDI-QKD and corre¬ 
sponds to the quantity computed by [l| , following [3, IZlj . 
This (over-estimated) secret-key rate is given by 

^DV-MDi = Pz^Yz^ [1 — H2{ex)] — Qz fe H2 {Ez), 

where = /rAtts exp[—(/r^i -h /is)] is the probabil¬ 
ity that Alice and Bob emit a single photon, with pLA 


7 


(^s) being the intensity of Alice’s (Bob’s) signal; 
is the yield in the Z-basis and is the error rate 
in the A-basis, assuming that the parties send single¬ 
photon states; Qz and Ez are, respectively, the gain 
and the quantum bit error rate (QBER) in the Z ba¬ 
sis; fe is the error correction inefficiency, and H 2 {x) = 
—X log 2 a: — (1 — a;) log 2 (l — x) is the Shannon entropy. 

Parameters e^, Qz and Ez, can be simulated 
assuming a series of conditions, which further qualify the 
result to be an upper bound of the actual rate. These 
include the modeling of the intrinsic error by means of 
two unitaries at the input of the beam splitter at the relay 
station [dlj. Considering single-photon detectors with 
efficiency rjd and dark count rate Yq , one may write P,|4l| 


Fi' = (1 - Fo)2 [4Fo2(1 - r,AVd)il - VBVd) 


+2Yo rjAVd + VBVd - 


3VAVBVd\ , VAVBVl 


^ 1 _ (1 - Fo)^(l - edfvAVBvl 

2 4F“ 


where F^^ = Fj^, and VA (vb) is the transmissivity of 
Alice’s (Bob’s) link with the relay. Then, one may write 


Qz 


-|- ^2 
2 


Ez = 


rii 


where and Vt 2 are given in Eqs. (A4) and (A5) of [l|. 

Assuming various choices for the basic parameters Vd, 
Yq and Cd, (with fe = 1.16 [i^), we maximize Adv-mdi 
over the intensities /iA and /tb, deriving the simulated 
theoretical rates shown in Fig. of the main text. 


2. Secret-key rate of CV-MDI-QKD 

The security proof of CV-MDI-QKD needs a dedicated 
discussion for infinite-dimensional systems which involves 
various elements, including the “de Finettization” of the 
classical data and the extremality of Gaussian states 
(see @ for details). From Alice’s amplitudes a, Bob’s 
amplitudes /3 and the relay outcomes 7, we can derive 
a joint classical probability p{a, /3, 7 ) which identifies a 
conditional “post-relay” state Pabi-y shared by Alice and 
Bob in the entanglement-based representation of the pro¬ 
tocol. Such a state is then purified into an environment 
E which is assumed to be fully controlled by Eve. From 
Pah |75 we can derive both Alice and Bob’s mutual infor¬ 
mation Iab, and Eve’s Holevo information xe (e.g., on 
Alice’s variable a). As a result, we may write the rate as 

7?cv-mdi = f,lAB — Xe, 

where f is the reconciliation efficiency of the classical 
codes for error correction and privacy amplification. This 
is the general method adopted to compute our experi¬ 
mental rate. 


In order to derive the theoretical rate, we have to model 
the most general Gaussian attack against the two chan¬ 
nels, which is compatible with observed channel trans¬ 
missivities, VA and Vb- This is done by combining 
the two lossy channels in the most general way. Since 
these canonical forms [T^ always admit a local (non- 
Stinespring ) d ilation with a beam splitter and a ther¬ 
mal mode |16l| . the two-mode Gaussian attack can be 
represented by two beam splitters subject to a generally- 
correlated two-mode Gaussian state for the environment. 

By means of local displacements and symplectic trans¬ 
formations, this state can be reduced to a zero-mean 
Gaussian state whose covariance matrix is in normal form 
'V{uiA,x!B,g,g'), where uja {^^b) is the thermal noise af¬ 
fecting Alice’s (Bob’s) link, and parameters g and g' de¬ 
scribe the correlations between Eve’s modes. In these 
conditions, Alice and Bob’s mutual information can be 
written as Iab = log 2 [(<i 3 -l- l)x“^], where ip is the modu¬ 
lation of the coherent states and x is the equivalent noise, 
decomposable as y = xioss +£, with xioss being the pure- 
loss noise and e{vA,VB,<^A,xiB,g,g') the ‘excess noise’. 
For any fixed value of the transmissivities and excess 
noise, we then optimize Eve’s Holevo information over 
the remaining degrees of freedom, i.e., loa, wb, g and g'. 
Thus, we compute a lower bound of the rate, denoted 
by R,pxiVA,VB,£) i- This quantity is asymmetric and 
decreases more rapidly in rjA than in rjB- For this reason, 
we obtain a further lower bound if we replace VA -A VAVd, 
where Vd takes into account of the overall efficiency of the 
GV Bell detection at the relay. This quantity is here used 
to compute the theoretical rates shown in the main text. 

Note that a simple analytical formula can be written 
in the case of ideal reconciliation C = 1 and large modu¬ 
lation (p ^ 1. In this case, we have @ 


R{va,Vb,£) = log2 


2(rjA+VB) 

e\VA-riB\x 


h 



h 

VA+VB 



VAVBX-fnA+VBff 

IriA-VBliriA+riB) 


where x = 2{r]A -b Vb)/vaVb + £ and 


h{x) 


x-bl, X + 1 X — 1 ^ X — 1 


In the symmetric case VA = Vb ■= V, this rate becomes 


Rix) = ^ (I “ 1) + 


16 

.e^x(x-4). 


3. Secret-key capacity 


The total transmissivity of an equivalent point-to- 
point lossy channel between Alice and Bob is equal to 
Vtot = VaVb- The maximum secret-key rate which is 
achievable by a GV-QKD protocol is the secret-key ca¬ 
pacity K of the channel, satisfying (Tzl - li^ 


l 0 g 2 


1 

1 Vtot 


<K< log 2 


/ 1 + Vtot \ 

V 1 ~ Vtot J 


























Appendix B: Reply to the “Appendix E: 

Addendum” of Xu et al. 

Here we provide an additional reply to Xu et al. who 
added an appendix to their comment (see the second 
version available at http://arxiv.org/abs/1506.04819v2). 
Most of the new comments are just repetitions of the old 
arguments and have been already replied to in our text 
above. However, we provide here, and again, a point-to- 
point rebuttal of these issues, also claryfing other new 
incorrect statements made by these authors. We apolo¬ 
gize with the reader for the repetitions triggered by this 
process. It is clear that Xu et al. are trying to make 
all their possible arguments against CV-QKD once they 
realised they were not able to approach the rate of CV- 
MDI-QKD. 

□ 1 Xu et al. claim: “Pirandola et al. agree with our main 
point.” 

■ 1 Our reply: No, we do NOT agree with their 
main point, and we are NOT contradicting 
our Nature Photonics paper [^. Xu et al. 

are clearly mis-quoting us. As already explained 
before, the rate of CV-MDI-QKD with practical 
devices and parameters is at least three orders- 
of-magnitude higher than that of DV-MDI-QKD 
with corresponding practical devices and parame¬ 
ters [4l|. The CV-rate also keeps an advantage of 
between two and three orders-of-magnitude with 
respect to the optimal realistic implementation of 
DV-MDI-QKD with the best available semicon¬ 
ductor single-photon detectors. This advantage is 
quantified in terms of bits per relay use and evalu¬ 
ated for various values (in dBs) of the channel loss. 
That being said, the theoretical possibility of using 
DV-MDI-QKD with cryogenic devices (SNSPDs) 
currently seems: Unnecessarily complex and very 
expensive; hard to miniaturise; not extendable to 
more complex networks (e.g., where each node may 
act as a user or as a relay); not extendable to 
mobile devices (which can be hot-spots as well); 
very fragile with respect to the performances of 
the SNSPDs, easily losing one-two orders of mag¬ 
nitude from > 90% to < 40% efficiencies. Most im¬ 
portantly, better performances could be achieved 
with practical implementations of CV-MDI-QKD 
with cheap and room-temperature devices. Unfor¬ 
tunately, Xu et al. keeps comparing our practical 
experimental data with the theoretical simulation 
of a potential cryogenic implementation. 

□2 Xu et al. claim: “Experimental results of CV-MDI- 
QKD done in free-space, at a non-telecom wave¬ 
length, and using nontelecom detectors cannot and 
should not be used as a demonstration of tele¬ 
com CV-MDI-QKD performance.” Plus other re¬ 
dundant statements about the use of a single laser 
etc. 


■2 Our reply: Despite the fact that ours is a proof- 
of-principle experiment in free space at 1064 nm, 
it gives a clear indication of the potential perfor¬ 
mances of the CV-MDI-QKD protocol in a fibre- 
based telecom-wavelength implementation, where 
highly efficient homodyne detectors are available at 
1550 nm and fibre-couplings are not an issue. This 
is already fully explained in the main text. In par¬ 
ticular, see our points (1) and (2) in the main text, 
their explanations and Fig. [TJ The use of a sin¬ 
gle laser is not a major issue as already extensively 
explained in point (iv) of the main text. There¬ 
fore, our experimental results can be used to 
make quantitative statements about the fu¬ 
ture performance of a field implementation 
of CV-MDI-QKD. 

□3 Xu et al. claim: “CV-MDI-QKD could have an 
advantage over DV-MDI-QKD only under rather 
restrictive conditions. We do not deny that 
CV-MDI-QKD might have an advantage over 
DV-MDI-QKD, but only in a rather restrictive 
parameter space where a combination of as¬ 
sumptions/conditions are simultaneously satisfied, 
namely, (a) asymptotic key rate for an infinitely 
long key, (b) high-efficiency (well above 85%) ho¬ 
modyne detectors, (c) highly asymmetric configura¬ 
tion where the relay is close to one of the two users, 
Alice or Bob, (d) low loss (i.e., short distance).” 

13 Our reply: This is another claim by these authors 
which is very easy to disprove. The various points 
have been already replied to before but, in any case, 
we can again stress the reasons here. 

(a) As already explained in point (ii) of the main 
text, finite-size effects support our experimental re¬ 
sults in the sense that these analyses tend to the 
asymptotic limit for blocks of > 10® data points, 
which is the size considered in our experiment 
Despite the fact that the theoretical rate is asymp¬ 
totic, there is no reason to believe that it would be 
sensibly affected by finite-size analyses. Here the 
main argument of Xu et al. is that composability 
security for coherent-state protocols against coher¬ 
ent attack has not yet proven to converge quickly to 
the asymptotic analysis. This is mainly a problem 
of finding the correct proof technique, it cannot be 
conjectured as a fundamental problem with CVs. 
As a matter of fact, this problem does not even ex¬ 
ist for squeezed-state protocols [2^. By contrast, it 
is known that larger data blocks (> 10^° points) 
are needed for DV-MDI-QKD with practical room- 
temperature detectors. 

(b) Homodyne detectors have high efficiencies (well 
above 85%) both at optical and telecom wave¬ 
lengths, free-space or coupled to fibre. This is typ¬ 
ical and already explained above. For instance see 
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the bullet points on page 2 of the main text. The 
value of 85% of Xu et al. is unreasonably too low. 

(c) As already stated in point (hi) of the main text 
and completely clear from Fig. [21 the CV proto¬ 
col can be run both in symmetric and asymmetric 
configurations with superior performances. 

(d) Typical distances are within the metropolitan 
range. For instance, see again Fig. [2] where they 
range between 6 and 25 km. 

□4 Xu et al. claim: “For CV-QKD with coherent states, 
practical composable secure key rates against the 
most general type of attacks have yet to be shown 
[...] In this respect, Pirandola et al. [23] confuse 
the restricted class of collective attacks with the 
most general class of coherent attacks [...] current 
security proofs against the most general type of co¬ 
herent attacks for CV-QKD with coherent states 
deliver basically zero key rate for any reasonable 
amount of signals” 

■4 Our reply: This has been already replied to above. 
Not having a proof of fast convergence is 
one thing, proving that there is no fast con¬ 
vergence is another. Xu et al. are either con¬ 
fused by this point, or they are trying to make 
a biased use of this argument. According to 
Xu et al, all the coherent-state protocols 
implemented so far, including the ground¬ 
breaking resu lts achieved in point-to-point 
CV-QKD (ITI. l34l |. -would then run the risk of 
delivering zero key rate in the composability 
security framework. This implication seems to 
be rather absurd, also considering the fact that, for 
squeezed-state protocols, fast convergence has al¬ 
ready been proven. And, yes...luckily we know the 
difference between collective and coherent attacks 
(among other things, some of our co-authors have 
defined the most general form of collective Gaus¬ 
sian attack against CV-QKD protocols [s^l. 

□5 Xu et al. claim: “The critical dependence of CV- 
MDI-QKD key rates on homodyne detection effi¬ 
ciency is down played by Pirandola et al.” 

■5 Our reply: No. This is just a repetition, already 
replied to in (b) of point 13 above. 

□6 Xu et al. claim: “Pirandola et al.’s free-space exper¬ 
iment is not a properly designed QKD demonstra¬ 
tion, thus the results shown in Fig. 1 are all purely- 
numerical”. Their reasons would be (a) “The use 
of a single laser”; (b) “Table-top experiment at a 
wavelength outside the telecom band” and (c) “In¬ 
correct noise model” (i.e., low excess noise). 

■6 Our reply: No. This is another repetition. 
Our proof-of-principle experiment is a properly- 
designed free-space QKD experiment, which pro¬ 
vides clear indications of the full potentialities of 


the protocol in a future field implementation with 
fibre connections at telecom wavelengths, as al¬ 
ready discussed in point M2 above. In particular: 

(a) About the single laser: As already explained 
before, the malicious manipulation of the local 
oscillator can be overcome with practical exper¬ 
imental techniques [H, [s^. Note that all CV- 
QKD protocols have been implemented with a 
common local oscillator, as is our CV-MDI-QKD 
protocol. Therefore, Xu et al. would au¬ 
tomatically claim that all CV-QKD proto¬ 
cols would not be “properly designed QKD 
demonstrations”. 

(b) About the table-top experiment: Again, this is 
already replied to in point M2 above. 

(c) About the noise model: As already explained 
in the main text, our experimental excess noise 
£ ~ 0.01 is not low but typical, fully comparable 
with the values reported in the fibre-optic experi¬ 
ment of [a, where the experimental excess noise 
was estimated to be e ~ 0.001 at 10® data points 
and £ ~ 0.008 at 10® data points, for Bob’s detec¬ 
tion at 53 km. At lower distances < 25 km (as is 
in our case), the excess noise can actually go below 
these values, which means that our experimental 
value £ ~ 0.01 can even be considered relatively 
high. The robustness of CV-MDI-QKD against ex¬ 
cess noise can also be appreciated from the anal¬ 
ysis done in the Supplementary Section IE6 of @ 
(in particular, see Fig. 5 there), where the security 
thresholds are proven to be robust against much 
higher excess noise (£ = 0.1). Even assuming the 
numbers given by Xu et al. (0.015), this is com¬ 
pletely compatible with our experimental value. 


□7 Xu et al. claim: “CV-MDI-QKD could be suitable 
only for particular network architectures” repeat¬ 
ing some arguments on the sub-optimal perfor¬ 
mance of the symmetric configuration. 

M7 Our reply: Xu et al. make several errors here: 

(a) A real network is very unlikely to be perfectly 
symmetric, but most of the nodes will be in an 
asymmetric configuration. 

(b) The model of star network they consider is very 
restrictive. This model is necessary if the relay 
needs to be implemented with very expensive cryo¬ 
genic detectors (as those suggested by these authors 
for DV-MDI-QKD). By contrast, CV-MDI-QKD 
would allow one to use cheap detectors for the re¬ 
lay, which means that every node in the network 
can play a role as a user or as a relay, depending 
on the situation. In this more flexible scenario, Al¬ 
ice just needs to connect to the closest (untrusted) 
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node available to secretly communicate with a re¬ 
mote (authenticated) Bob. 

(c) Finally, even assuming the symmetric config¬ 
uration, Alice and Bob can be separated by a 6 
km-long fibre, which is not exactly a short distance 
at the metropolitan scale. 

At the end of their “Addendum” Xu et al. make some 
“Final remarks”. Some of these are completely secondary 
issues, others are just repetitions of previous points which 
have been already addressed or refuted, especially the re¬ 
iterated points on the finite-size effects, the use of a single 
laser, and the homodyne detectors. We note that Xu et 
al. misunderstood in which sense our theoretical rate 


is “optimal”, thinking that it would be a sort of upper 
bound. The optimality is clearly intended as a minimiza¬ 
tion over all possible attacks which therefore qualifies the 
key rate as a lower bound - see point (i) of the main text 
for full details. Thus, what Xu et al. say (“We admit that 
it was unclear to us whether or not the realistic Gaussian 
attack considered in [1] to derive the theoretical rate was 
indeed optimal, or if it provided an upper bound on the 
theoretical rate. So, in our simulations we opted for the 
most favourable case for CV-MDI-QKD by considering 
that the attack is optimal....We are glad to see that Pi- 
randola et al. [23] confirm this.”) is not confirmed by us 
and it is clearly wrong. 



